API
POST /api/scan starts a scan. GET /score/{domain} and GET /api/score/{domain} only read a stored score. Homepage and protocol fetches use the user agent Waymark/1.0.
JSON responses send Access-Control-Allow-Origin: *. Limits are fixed windows, per IP: 20 scans per minute (POST /api/scan, POST /api/scan/checks, GET /api/scan/stream, POST /api/scan/notify, and MCP scan_domain), 10 writes per minute (POST /api/contact and POST /api/feedback), and 4 journeys per 10 minutes. POST /api/scan and GET /api/scan/stream reuse a stored scan for 6 hours unless force is set (maxAgeSeconds defaults to 21600). The homepage Scan button and the score-page re-scan button call GET /api/scan/stream?force=1, so they do not use that cache. MCP scan_domain always runs a fresh scan and does not send the notify email.
Scan
POST /api/scan — JSON { url, force?, maxAgeSeconds? }. ?include=essentials adds the essentials reading.
GET /api/scan/stream?url= — SSE layer / check / complete
POST /api/scan/checks — JSON { url, checkIds } merges those checks into the stored scan, probing only what those checks read. If nothing is stored yet, a full scan is saved instead.
GET /api/score/:domain — ?include=essentials · ?competitors=1 (2 above / self / 2 below)
GET /api/badge/:domain
GET /api/checks — catalog
Index
GET /api/leaderboard
GET /api/discover?intent=
GET /api/research
POST /api/feedback { domain, message } · GET /api/feedback/:domain
POST /api/contact { name, email, message }
Journey
GET /api/journey/intents
POST /api/journey { url, intent?, harness? } — harness: browser, claude, codex, or both (two jobs). We run remote Claude Code and Codex, not Ora Deep Scan. Intent may be a preset id: pricing, account, api, start, support
GET /api/jobs/:id · GET /api/jobs?ids=a,b
GET /api/journey/:domain
MCP
GET /.well-known/mcp.json
POST /api/mcp JSON-RPC (initialize, tools/list, tools/call). See MCP setup.
CLI
node scripts/waymark.mjs audit https://example.com
node scripts/waymark.mjs journey https://example.com --intent pricing
node scripts/waymark.mjs checks · node scripts/waymark.mjs checks https://example.com
Set WAYMARK_URL to point at another origin.